Homepage

Buffer Overflow Affecting kernel6.12-tools-debuginfo package, versions <1:6.12.100-125.179.amzn2023

Severity

 Recommended
high

Based on Amazon Linux security rating.

Threat Intelligence

EPSS
0.13% (4th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-AMZN2023-KERNEL612TOOLSDEBUGINFO-18912082
  • published18 Aug 2026
  • disclosed27 Jul 2026
Report a new vulnerability Found a mistake?

Introduced: 27 Jul 2026

NewCVE-2026-64532  (opens in a new tab)
CWE-120  (opens in a new tab)

How to fix?

Upgrade Amazon-Linux:2023 kernel6.12-tools-debuginfo to version 1:6.12.100-125.179.amzn2023 or higher.
This issue was patched in ALAS2023-2026-2057.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel6.12-tools-debuginfo package and not the kernel6.12-tools-debuginfo package as distributed by Amazon-Linux. See How to fix? for Amazon-Linux:2023 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}

In do_action()'s UpdateRecordDataRoot (fslog.c:3489) and UpdateRecordDataAllocation (fslog.c:3697) cases, the memmove destination is Add2Ptr(e, le16_to_cpu(e-&gt;view.data_off)), where e->view.data_off comes from an on-disk NTFS_DE inside an INDEX_ROOT or INDEX_BUFFER. Neither case validates view.data_off + dlen against e->size; the existing check_if_index_root / check_if_alloc_index helpers walk the entry chain and validate the entry's offset, but not its internal view fields.

The neighbouring read sites (e.g., fs/ntfs3/index.c when iterating view entries) check view.data_off + view.data_size <= e->size. Apply the same bound at the two memmove sites.

Reproduced under UML+KASAN on mainline 8d90b09e6741 via pr_warn-only probe instrumentation: with view.data_off forced to 0xFFFC, the memmove writes 32 bytes past the end of the NTFS_DE.

This is similar in shape to Pavitra Jha's 2026-05-02 patch "fs/ntfs3: prevent oob in case UpdateRecordDataRoot" (<20260502105008.21827-1-jhapavitra98@gmail.com>) which proposes calling ntfs3_bad_de_range(); that helper does not exist in mainline. This patch uses inline checks.